How determine the right xml to write out

Question

<?xml version="1.0" encoding="UTF-8"?>
<idmef:IDMEF-Message version="1.0"  xmlns:idmef="http://iana.org/idmef"&gt;
 <idmef:Alert messageid="abc123456789">
   <idmef:Analyzer analyzerid="bc-corr-01">
     <idmef:Node category="dns">
       <idmef:name>correlator01.example.com</idmef:name>
     </idmef:Node>
   </idmef:Analyzer>
       <idmef:CreateTime ntpstamp="0xbc72423b.0x00000000">2000-03-09T15:31:07Z
   </idmef:CreateTime>
   <idmef:Source ident="a1">
     <idmef:Node ident="a1-1">
       <idmef:Address ident="a1-2" category="ipv4-addr">
         <idmef:address>192.0.2.200</idmef:address>
       </idmef:Address>
     </idmef:Node>
   </idmef:Source>
   <idmef:Target ident="a2">
     <idmef:Node ident="a2-1" category="dns">
       <idmef:name>www.example.com</idmef:name>
       <idmef:Address ident="a2-2" category="ipv4-addr">
         <idmef:address>192.0.2.50</idmef:address>
       </idmef:Address>
     </idmef:Node>
     <idmef:Service ident="a2-3">
       <idmef:portlist>5
       </idmef:portlist>
     </idmef:Service>
   </idmef:Target>
   <idmef:Classification text="Login Authentication">
     <idmef:Reference origin="vendor-specific">
       <idmef:name>portscan</idmef:name>
       <idmef:url>http://www.vendor.com/portscan&lt;/idmef:url&gt;
     </idmef:Reference>
   </idmef:Classification>
 <idmef:Assessment>
  <idmef:Impact severity ="high" completion ="failed" type ="file" >
  </idmef:Impact>
 </idmef:Assessment>
 </idmef:Alert>
 </idmef:IDMEF-Message>

I'm working with a xml messaging system, where a message packet is read from a queue, and applied against a rule with a pattern in it. If the pattern matches, the rule fires and some elements, node etc of the xml are read and stored. The definition of what to be read from the message is defined using Xpath expression. For example, the following xpath takes the severity attribute and store it.

name.set(".//idmef:Classification/idmef:Assesment/idmef:Impact/@severity","high");

So, I would take that xpath, compile it, and read the serverity attribute and store for latter use.

When I go to create the new XML message using the stored value, there may be a case that the completion and type attribute are mandatory.

So question is, how do I check if those attributes need to be written out. I know that schema is involved somehow, but how do you do it. More to the point, if the user selects only the severity attribute, how would I go about, adding in the rest of the structure, like Classification, Message and other elements, when have additional xpath lookups, for example down at

Bob.

Answer 1

The commenters are correct - you need to first fix your XML to make it well formed.

However, If I understand your problem correctly, you need write out some XML, adding or changing some attributes.

If this is what you need I would try using an XSL transform to add the attributes. Here is a modified version of the identity transform that should be close to what you need. if you need some conditional logic then surround the attribute tags with xsl:if

<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:fn="http://www.w3.org/2005/xpath-functions" 
    xmlns:idmef="http://iana.org/idmef" xpath-default-namespace="http://iana.org/idmef"&gt;
        <xsl:output method="xml" version="1.0" encoding="UTF-8" indent="yes"/>

        <xsl:template match="@*|node()">
         <xsl:copy>
          <xsl:apply-templates select="@*|node()"/>
         </xsl:copy>
        </xsl:template>

        <xsl:template match="Impact">
         <xsl:copy>
          <xsl:copy-of select="@*"/>
          <xsl:attribute name="severity">high</xsl:attribute>
          <xsl:attribute name="completion">failed</xsl:attribute>
          <xsl:attribute name="type">file</xsl:attribute>
          <xsl:apply-templates/>
         </xsl:copy>
        </xsl:template>
    </xsl:stylesheet>

Answer 2

You could:

• Open original XML (A)
• Create a new XML document (B)
• Run your xpath against (A)
• Add matching results to (B)
• Save (B)

This makes any sense?

Answer 3

I found an answer here on stackoverflow, and here it is. Create XML Nodes from XPath I know it is as far away from how I described it above, but at the time I was designing it, I didn't have a scobie how it would work.